Directive (EU) 2022/2555, known as NIS2, significantly widened the range of organisations with cybersecurity obligations. In Bulgaria the requirements are transposed through the Cybersecurity Act. Many companies that never thought about regulation are now in scope — often without knowing it.
Here is how to run a first check in a few minutes.
Step 1: Which sector are you in?
The directive lists 18 sectors in two annexes.
Annex I — sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space.
Annex II — other critical sectors: postal and courier services, waste management, chemicals, food (production, processing and distribution), manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment), digital providers (online marketplaces, search engines, social networks) and research.
If your activity is in none of these sectors, NIS2 generally does not apply directly — but read step 5.
Step 2: How big is your company?
NIS2 applies mainly to medium and large enterprises:
- medium — 50 or more employees, or annual turnover (balance sheet) above €10 million;
- large — 250 or more employees, or annual turnover above €50 million.
Small and micro enterprises are generally out of scope.
Step 3: Is there an exception where size does not matter?
Some categories are in scope regardless of size — for example providers of public electronic communications networks and services, trust service providers, top-level domain name registries and DNS service providers. A Member State can also designate an organisation that is the sole provider of an essential service, or whose disruption would have a significant impact.
Step 4: Essential or important entity?
| Entity type | Who | Maximum fine |
|---|---|---|
| Essential | Mainly large companies in Annex I | up to €10M or 2% of worldwide turnover |
| Important | Medium companies in Annex I, and medium and large companies in Annex II | up to €7M or 1.4% of worldwide turnover |
The main difference is supervision: essential entities face proactive inspections, important entities ex-post supervision after a report or incident. The measures they must apply are the same.
Step 5: What happens if you are in scope?
Article 21 of the directive requires cybersecurity risk-management measures, including:
- risk analysis and information system security policies;
- incident handling;
- business continuity — backups, disaster recovery, crisis management;
- supply chain security;
- security in acquisition, development and maintenance of systems;
- assessing the effectiveness of the measures;
- basic cyber hygiene and training;
- cryptography and encryption;
- human resources security, access control and asset management;
- multi-factor authentication and secured communications.
Significant incidents must also be reported within strict deadlines: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Management approves the measures, is accountable for their implementation and must undergo training.
Even if you are not in scope of NIS2, if you supply a company that is, it will pass requirements down the supply chain — questionnaires, contract clauses, audits. In practice NIS2 affects many more companies than the law lists.
The fastest route to compliance
If you already have or are implementing ISO/IEC 27001, you have covered a large part of the Article 21 measures. What remains are the NIS2-specific requirements — the reporting procedure, management accountability and training, and registration.
Not sure whether you are in scope? The check takes one conversation — and it is free.